tokno[.]im

This domain, tokno.im, is flagged as a confirmed brand impersonation site targeting users of the Cosmos blockchain ecosystem. Analysis indicates the site mimics the legitimate imToken wallet interface, presenting a Chinese-language page titled 'imToken 官网｜以太坊和比特币区块链钱包.' The objective appears to be credential harvesting or cryptocurrency theft, though no explicit drainer kit signatures were observed in initial scans. The domain impersonates Cosmos-related services, likely exploiting user trust in the imToken brand to facilitate unauthorized transactions or data exfiltration. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 38.246.253.131, hosted within AS979 (NetLab Global) in Hong Kong. VirusTotal reports 19 detections out of 95 security vendors, indicating moderate consensus on malicious classification. The domain was registered on February 21, 2026, through an undisclosed registrar, a common tactic to obscure ownership. At the time of assessment, the domain appeared on a single security blocklist and was not listed in Google Safe Browsing. No SSL certificate was present, further degrading the site's perceived legitimacy. The domain has since been taken offline, likely in response to detection and reporting. However, residual risk persists due to potential re-registration or migration of the phishing infrastructure to alternate domains. Users who interacted with the site prior to takedown should assume credential exposure and take immediate remediation steps, including revoking wallet permissions and monitoring for unauthorized transactions. Security teams are advised to update detection rules to include the observed IP and domain patterns, while users should verify wallet authenticity exclusively through official channels.